Configuration

Every knob the Hub has is an environment variable, read at boot from .env.local (locally) or the host's env (deployed). This page is the reference: what each one does, what happens when it's absent, and which ones are secrets in the "rotate if exposed" sense.

Required to boot

Variable	Purpose	Notes
DATABASE_URL	PostgreSQL connection string	Local: postgres://postgres:postgres@localhost:5433/youngo_dev. Deployed: the Neon pooled connection string
PAYLOAD_SECRET	Signs sessions and encrypts tokens	Any long random string. Losing it invalidates every session
APP_BASE_URL	Canonical origin for links in mail, feeds	e.g. https://hub.youngo.example

Payload refuses to start without the first two. APP_BASE_URL falls back to the request origin where it can, but mail links need the real value or they point at localhost.

Email

Variable	Purpose
SMTP_URL	Full connection string — the one-shot alternative to the parts below
SMTP_HOST SMTP_PORT SMTP_SECURE SMTP_USER SMTP_PASS	Server settings when not using SMTP_URL
EMAIL_FROM	The From: address members see
EMAIL_RECIPIENT_ALLOWLIST	Comma-separated allowlist — set this on staging/preview so test mail never reaches real members
EMAIL_UNSUBSCRIBE_SECRET	Signs category-unsubscribe links

Without SMTP the outbox simply queues — nothing is lost, and /api/member/admin/notifications/outbox shows the backlog.

Web push

Variable	Purpose
VAPID_PUBLIC_KEY / VAPID_PRIVATE_KEY	The VAPID keypair — generate with node scripts/setup/generate-vapid-keys.mjs
VAPID_SUBJECT	A mailto: contact for push providers

Agent MCP service

Variable	Purpose
HUB_TOKEN	Bearer token for a Hub account — the identity agents act under
HUB_EMAIL / HUB_PASSWORD	Alternative to HUB_TOKEN: the MCP logs in for a session
MCP_TOKEN	Bearer token the MCP service itself requires from its callers
MCP_ALLOW_ANONYMOUS	1 permits unauthenticated MCP calls — local development only
HUB_ORIGIN	Where the MCP finds the Hub API (default http://localhost:3000)

The bright-line rule: the MCP gets HUB_TOKEN, never DATABASE_URL. It is an API client; giving it the database defeats the entire isolation.

Agent session memory

Variable	Purpose
HINDSIGHT_API_KEY	Key for the project-scoped memory MCP bank agents share for session memory — .env.local only, never committed

npm run sync:mcp writes the unified hub server into local agent configs (.mcp.json, .zed/settings.json, .agents/tool-cfg/*) — content tools when HUB_* credentials are present, memory tools when HINDSIGHT_API_KEY is. Agent tools covers the setup.

Operational flags

Variable	Purpose
NEXT_PUBLIC_HUB_DEMO	Marks an environment as demo — the UI shows a banner and robots stay noindexed. HUB_DEMO_MODE is an accepted alias
HUB_DISABLE_RATE_LIMIT	Turns off throttles — test environments only
PRINT_ADMIN_RESET_URLS	Emergency opt-in: lets provisioning print a reset URL for a newly created bootstrap admin. Routine deploys never print reset URLs
SENTRY_DSN	Error reporting. Scrubbed server-side — see the note below
VERCEL_URL / VERCEL_BRANCH_URL	Set by Vercel; used to derive the deployment's own origin

Sentry and privacy

SENTRY_DSN is optional and the Sentry config is defensive by default: sendDefaultPii off, request data filtered server-side before events leave. The rule that matters for reviewers is that member data does not get logged or shipped to Sentry — check src/lib/sentry.ts when you touch error paths.

CI/CD variables

Variable	Where	Purpose
NEON_PROJECT_ID	GitHub vars	The Neon project preview branches attach to
NEON_API_KEY	GitHub secrets	Authorises neonctl to create/delete pr-* branches
Vercel envs	Vercel dashboard	DATABASE_URL (preview+prod), PAYLOAD_SECRET, APP_BASE_URL

The one rule

Everything above lives in env, never in source. The repository carries zero configuration values that are secrets, and .env* files are gitignored. If you catch yourself about to hard-code a value "just for now" — that moment is the whole reason this page exists.